AB double-lock cabinet bidirectional authentication method based on SM4 and RF-ID

Abstract

This invention discloses a two-way authentication method for AB dual-lock cabinets based on SM4 and RF-ID, belonging to the field of electronic authentication technology. The invention includes: inserting an electronic key and activating the control board; the control board verifying the electronic key's identity information; collecting and encoding the mechanical key's operating status; generating a temporary session key based on the mechanical status; the control board and the electronic key performing two-way authentication; releasing the electronic lock pin upon successful authentication; recording and uploading the operation log and enabling permissions; and executing locking and alarm strategies upon authentication failure. This invention integrates the real-time operating status of the mechanical key as a dynamic seed into the SM4 session key derivation and two-way challenge-response authentication process, achieving deep real-time coupling and interlocking between electronic authentication and mechanical operation.

Description

Technical Field

[0001] This invention belongs to the field of electronic authentication technology, and in particular relates to a two-way authentication method for AB dual-lock cabinets based on SM4 and RF-ID. Background Technology

[0002] The AB dual-person dual-lock mechanism is a highly secure physical access control method. Its core lies in enhancing overall security through the separation of permissions and operational constraints. In this mechanism, opening a protected container (such as a cabinet or safe) requires the collaborative operation of two personnel with different responsibilities or permissions (usually referred to as Person A and Person B): Person A holds a mechanical key or has the authority to open the physical lock, while Person B holds an electronic key or has the authority to obtain digital authentication. The two authentication methods are independent yet interconnected. The final opening mechanism of the lock (such as the bolt or handle) can only be released after both have completed their valid authentication sequentially or simultaneously. This achieves the security control goal of "dual operation, mutual supervision, and indispensability."

[0003] In current high-security scenarios, such as the management of core data server racks, an A / B dual-person, dual-lock mechanism is commonly used to distribute permissions and ensure mutual checks and balances. This mechanism typically consists of two independent parts: a mechanical lock and an electronic lock. The mechanical lock relies on a physical key and lock cylinder structure for authentication; the electronic lock uses a smart key and digital authentication between the control board (such as RF-ID identification and standard encryption algorithms). While both types of authentication physically coexist within the same lock body, they are often logically and procedurally connected in series or a simple parallel relationship.

[0004] In existing technologies, the authentication process of electronic locks is typically completed in a separate stage before or after the mechanical key operation. The keys, random numbers, or challenge codes relied upon for authentication are mostly derived from pre-shared static parameters or time-related dynamic factors, and are unrelated to the real-time operating state of the mechanical lock. This creates a clear "gap" at the logical level between electronic authentication and mechanical operation.

[0005] Attackers can exploit this gap to launch attacks. For example, an attacker might use technical means to simulate or replay a legitimate electronic authentication signal, causing the system to mistakenly believe that the electronic part has passed verification. This could then induce the system to release the electronic lock even if the mechanical part is illegally operated (or not operated). Conversely, an attacker might also attempt to bypass or interfere with subsequent electronic authentication processes when the mechanical part is briefly illegally operated. The root cause is that the two authentication steps, which should be mutually restrictive, fail to establish an inseparable binding at the cryptographic level with the physical actions of the same operator at the same time. Therefore, the following solutions are proposed to address these problems. Summary of the Invention

[0006] The purpose of this invention is to provide a two-way authentication method for AB dual-lock cabinets based on SM4 and RF-ID. By integrating the real-time operation status of the mechanical key as a dynamic seed into the SM4 session key derivation and two-way challenge-response authentication process, it can achieve deep real-time coupling and interlocking between electronic authentication and mechanical operation, solving the problem that there is a logical gap between electronic authentication and mechanical operation in the existing AB dual-lock system, which is easily exploited by attackers to carry out replay or timing fraud.

[0007] To solve the above-mentioned technical problems, the present invention is achieved through the following technical solution: This invention discloses a two-way authentication method for AB dual-lock cabinets based on SM4 and RF-ID, applicable to dual-lock systems containing mechanical lock authentication units and intelligent electronic lock authentication units, comprising the following steps: After the smart electronic key is inserted into the core control board and a connection is established, both parties conduct a preliminary mutual verification based on the RF-ID identifier and the preset code; The physical state signals triggered by the operation of the mechanical key are collected in real time, and the physical state signals are fused with time information to generate a dynamic mechanical state summary. Based on the machine state summary, current time information, root key shared by both parties, and randomly generated numbers, a temporary session key for the current session is generated through a time-sensitive key derivation process. The core control board and the smart electronic key use the temporary session key to execute a two-way challenge-response authentication process, wherein the challenge response verification issued by the core control board and the reverse challenge response verification issued by the smart electronic key are both successful, and the mechanical state summary is incorporated into the reverse challenge response verification process to complete two-way identity authentication and electromechanical state synchronization confirmation. After successful two-way authentication and detection that the mechanical locking pin is in the unlocked state, the core control board drives the electronic locking pin to release, thus completing the authorization to open.

[0008] Furthermore, the preliminary mutual verification step specifically includes: The core control board reads the unique RF-ID identifier stored in the smart electronic key; The smart electronic key sends a preset smart control code to the core control board. This code includes classification information, area information, and device identification information. The core control board compares the received RF-ID identifier and smart control code with the local list of legitimate authorizations. Only after both are verified will the subsequent authentication process be initiated.

[0009] Furthermore, the step of generating a dynamic summary of the mechanical state specifically includes: Within a preset time window, the level status signals output by the sensors associated with the mechanical key operation are continuously collected at fixed time intervals to form an original state sequence. The original state sequence is concatenated and combined with the current high-precision timestamp; The first cryptographic hash algorithm is used to process the concatenated data to obtain the first intermediate data; The first intermediate data is encrypted using the SM4 encryption algorithm with a preset seed key. Extract a data segment of a specified length from the encryption result as the machine state digest.

[0010] Furthermore, the time-sensitive key derivation process specifically includes: the core control board generating a first random number, the smart electronic key generating a second random number, and exchanging them during initial mutual verification or subsequent communication; The core control board and the smart electronic key each use the same shared root key to perform SM4 encryption on two different sequences of data blocks. Each data block contains the mechanical state digest, the current timestamp, and the exchanged random number. Perform a bitwise XOR operation on the outputs of the two SM4 encryption operations to obtain the final temporary session key.

[0011] Furthermore, the challenge and verification steps initiated by the core control board in the two-way challenge-response authentication process include: The core control board generates a third random number as a challenge number, which is then encrypted using the SM4 algorithm with the temporary session key and sent to the smart electronic key. The smart electronic key decrypts to obtain the challenge number, generates a fourth random number as the response number, performs a first logical operation on the challenge number and the response number, and then uses the temporary session key to encrypt and form the first response ciphertext. The smart electronic key simultaneously generates a fifth random number as a reverse challenge number, which is then encrypted using the temporary session key and sent together. The core control board decrypts the first response ciphertext, performs a reverse first logical operation on the obtained data to separate the response number, and verifies its validity.

[0012] Furthermore, the reverse challenge and verification steps initiated by the smart electronic key in the two-way challenge-response authentication process include: After verifying the validity of the response number, the core control board decrypts to obtain the reverse challenge number; The reverse challenge number and the machine state digest are subjected to a second logical operation, and the operation result is encrypted using the temporary session key to form a second response ciphertext, which is then sent to the smart electronic key. The smart electronic key decrypts the second response ciphertext and performs a reverse second logical operation on the obtained data to extract the verification value of the mechanical state summary; The smart electronic key compares the verification value with its local state summary calculated based on the mechanical state feature information obtained from the core control board. If the two match, it confirms that the core control board is legitimate and the mechanical state is synchronously valid.

[0013] Furthermore, after the authorization is granted, the process also includes operation execution and log recording steps: The smart electronic key displays the authorization success status and operable operation prompts on its screen. The core control board maintains the electronic lock pin in the released state for a limited time, and automatically relocks if no handle operation is detected after the time limit. The smart electronic key and the core control board respectively encrypt and upload operation logs containing timestamps, identity identifiers, authentication results, and de-identified mechanical status information locally and / or to the superior management system.

[0014] Furthermore, the method also includes an authentication failure handling step: If a verification error occurs at any stage of the initial mutual verification, key derivation, or two-way challenge-response authentication, the authentication process shall be terminated immediately and the electronic lock shall be locked. A delayed retry mechanism is activated, and the next authentication attempt will have to wait for a delay time dynamically calculated based on the number of consecutive failures; When the number of consecutive failures reaches a threshold, a local audible and visual alarm is triggered, and a security alarm message is sent to the remote monitoring center via the network communication module.

[0015] Furthermore, the smart electronic key integrates a rechargeable battery, which simultaneously provides power to the core control board when inserted, ensuring that the authentication process can still proceed normally when the lock body has no independent external power supply.

[0016] Furthermore, the first logical operation and the second logical operation are bitwise XOR operations.

[0017] The present invention has the following beneficial effects: 1. This invention enhances the integrity and indivisibility of the authentication process. By introducing the real-time physical operation state of the mechanical key as a dynamic variable into the electronic authentication process, the mechanical opening action and electronic identity verification are deeply coupled to form a continuous and interlocked authentication whole. The two-way challenge-response process between the electronic key and the control board, in which the generation of the session key directly depends on the real-time state sequence of the mechanical operation, ensures that no single authentication link can be completed independently or counterfeited without the other links. This design makes it difficult for attackers to obtain illegal authorization by cracking the mechanical or electronic parts in isolation, increasing the overall difficulty of cracking and enhancing the inherent security correlation of the system.

[0018] 2. This invention enhances the system's resistance to replay attacks and man-in-the-middle attacks. The session key used in the authentication process is not fixed or simply updated periodically, but is derived from the root key, timestamp, random numbers from both parties, and a key real-time machine state digest, possessing strong timeliness and uniqueness. The two-way challenge-response mechanism not only verifies identity, but its response content also incorporates machine state information, making each authentication interaction bound to a specific, unreproducible operational context. Even if an attacker intercepts a communication data session, they cannot successfully replay it at another time or on another device without the same mechanical operation sequence and state, effectively interfering with attack paths based on data reuse.

[0019] 3. This invention improves the system's adaptability in non-standard or adversarial environments. Since the core authentication logic does not rely on continuous network connections or remote server verification, but is based on the lock's local physical state sensing and pre-set cryptographic elements, the system can still maintain complete high-strength authentication functionality in mobile, offline, or network-restricted scenarios. The mechanical operation state serves as a dynamic seed, allowing the authentication key to change naturally with the actual operating environment, reducing dependence on preset static environment parameters. This self-contained authentication mechanism enhances the system's reliability and independence in complex deployment environments, ensuring consistent execution of security policies under various operating conditions.

[0020] Of course, any product implementing this invention does not necessarily need to achieve all the advantages described above simultaneously. (See attached drawings.) To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating a two-way authentication method for AB dual-lock cabinets based on SM4 and RF-ID according to the present invention. Detailed Implementation

[0022] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] Please see Figure 1 As shown, this invention is a bidirectional authentication method for AB dual-lock cabinets based on SM4 and RF-ID, applied to a dual-lock system containing a mechanical lock authentication unit and an intelligent electronic lock authentication unit, including the following steps: After the smart electronic key is inserted into the core control board and a connection is established, both parties conduct a preliminary mutual verification based on the RF-ID identifier and the preset code; The system collects physical state signals triggered by mechanical key operation in real time, and fuses the physical state signals with time information to generate a dynamic mechanical state summary. Based on the machine state digest, current time information, root key shared by both parties, and randomly generated numbers, a temporary session key for the current session is generated through a time-sensitive key derivation process. The core control board and the smart electronic key use a temporary session key to perform a two-way challenge-response authentication process. The challenge-response verification issued by the core control board and the reverse challenge-response verification issued by the smart electronic key are both successful. The mechanical state digest is incorporated into the reverse challenge response verification process to complete two-way identity authentication and electromechanical state synchronization confirmation. After successful two-way authentication and detection that the mechanical locking pin is in the unlocked state, the core control board drives the electronic locking pin to release, completing the authorization to open.

[0024] The initial mutual verification process specifically includes: The core control board reads the unique RF-ID identifier stored in the smart electronic key; The smart electronic key sends a pre-set smart control code to the core control board. This code contains classification information, area information, and device identification information. The core control board compares the received RF-ID identifier and smart control code with the local list of legitimate authorizations. Only after both are verified will the subsequent authentication process be initiated.

[0025] The specific steps for generating a dynamic summary of the mechanical state include: Within a preset time window, the level status signals output by the sensors associated with the mechanical key operation are continuously collected at fixed time intervals to form an original state sequence. The original state sequence is concatenated and combined with the current high-precision timestamp; The first cryptographic hash algorithm is used to process the concatenated data to obtain the first intermediate data; The first intermediate data is encrypted using the SM4 encryption algorithm with a preset seed key. Extract a data segment of a specified length from the encrypted result to serve as a machine state digest.

[0026] The time-sensitive key derivation process specifically includes: The core control board generates the first random number, and the smart electronic key generates the second random number, which are then exchanged during initial mutual verification or subsequent communication. The core control board and the smart electronic key each use the same shared root key to perform SM4 encryption on two different sequences of data blocks. Each data block contains a mechanical status digest, a current timestamp, and a random number after the exchange. Perform a bitwise XOR operation on the outputs of the two SM4 encryption operations to obtain the final temporary session key.

[0027] The challenge and verification steps initiated by the core control board in the two-way challenge-response certification process include: The core control board generates a third random number as the challenge number, which is then encrypted using the SM4 algorithm with a temporary session key and sent to the smart electronic key. The smart electronic key is decrypted to obtain the challenge number, and a fourth random number is generated as the response number. After performing the first logical operation on the challenge number and the response number, the first response ciphertext is formed by encrypting it with the temporary session key. The smart electronic key simultaneously generates a fifth random number as a reverse challenge number, which is then encrypted using a temporary session key and sent together. The core control board decrypts the first response ciphertext, performs a reverse first logical operation on the obtained data to separate the response number, and verifies its validity.

[0028] The reverse challenge and verification steps initiated by the smart electronic key in the two-way challenge-response authentication process include: After verifying the validity of the response number, the core control board decrypts and obtains the reverse challenge number. The reverse challenge number and the machine state digest are subjected to a second logical operation, and the operation result is encrypted using a temporary session key to form a second response ciphertext which is then sent to the smart electronic key. The smart electronic key decrypts the second response ciphertext and performs a reverse second logical operation on the obtained data to extract the verification value of the mechanical state summary; The smart electronic key compares the verification value with its local state summary calculated based on the mechanical state feature information obtained from the core control board. If the two match, it confirms that the core control board is legitimate and the mechanical state is synchronously valid.

[0029] After authorization is granted, the process also includes operation execution and logging steps: The smart electronic key displays the authorization success status and prompts for available operations on its screen. The core control board maintains the electronic lock pin in the released state for a limited time, and automatically relocks if no handle operation is detected after the time limit. The smart electronic key and the core control board respectively encrypt and upload operation logs containing timestamps, identity identifiers, authentication results, and de-identified mechanical status information locally and / or to the superior management system.

[0030] The method also includes authentication failure handling steps: If a verification error occurs at any stage of the initial mutual verification, key derivation, or two-way challenge-response authentication, the authentication process shall be terminated immediately and the electronic lock shall be locked. A delayed retry mechanism is activated, and the next authentication attempt will have to wait for a delay time dynamically calculated based on the number of consecutive failures; When the number of consecutive failures reaches a threshold, a local audible and visual alarm is triggered, and a security alarm message is sent to the remote monitoring center via the network communication module.

[0031] The smart electronic key integrates a rechargeable battery, which provides power to the core control board when inserted, ensuring that the authentication process can still proceed normally when the lock body has no independent external power supply.

[0032] The first logical operation and the second logical operation are bitwise XOR operations. A specific application of this embodiment is as follows: Step S1: Insert the smart electronic key and start the core control board. Team B inserts the smart electronic key B into the electronic key socket C2 of the lock; the contactor at the front end of the electronic key B connects to C2, providing power to the core control board E1 and establishing a communication link; after the core control board E1 is powered on, it initializes the microprocessor CPU, SM4 encryption module, RF-ID reading module and I / O interface, and detects the current state (high / low level) of the micro switch D1 on the mechanical key transmission side; the control board E1 enters the waiting state for authentication instructions.

[0033] Step S2, RF-ID and Smart Code Mutual Verification The core control board E1 reads the RF-ID tag built into the electronic key B via near-field communication to obtain its unique identification code (e.g., an 8-byte ID). Simultaneously, the electronic key B sends a preset smart control code to the control board E1. This code includes: enterprise customer classification code (2 bytes), area code (2 bytes), lock type number (2 bytes), key index number (1 byte), and reserved fields (4 bytes), totaling 11 bytes. The control board E1 compares the received RF-ID and smart code with the locally stored list of valid codes. If either does not match, it jumps to step S8 (authentication failure handling); if they match, it proceeds to step S3.

[0034] Step S3: Real-time acquisition and encoding of mechanical key status. Group A inserts mechanical key A into mechanical lock cylinder C6 and begins rotation; the transmission structure C9 of the mechanical key is displaced, triggering a change in the state of micro switch D1 (e.g., from low to high level); the core control board E1 acquires the state signal of D1 in real time and converts it into a state sequence. Let the sampling time window be... to The sampling interval is The state sequence is obtained as follows: in, For the first in the sequence Mechanical state values ​​at each sampling point Integer index, starting from 0. This indicates that the switch is closed (high level). Indicates the switch is off (low level); Control board E1 corresponds to... Compress and encode the data to generate an 8-byte machine condition summary. : In the formula, The machine status summary is an 8-byte fixed-length data set that is the core feature value of the machine's operating status after compression and encryption. To use the key The symbol for encrypting the data within parentheses using the SM4 algorithm; This is the seed key, a fixed key pre-installed in the core control board E1, used for the initial encryption transformation; To perform hash operations on the data within the parentheses, this embodiment specifies the use of the SM3 algorithm; For data concatenation operators; For timestamps, it is a 4-byte data record of the current UTC (Coordinated Universal Time). For truncation operations, indices 0:7 indicate retrieving the first 8 bytes (byte indices from 0 to 7) of the result data within the parentheses.

[0035] Step S4: Time-sensitive key derivation core control board E1 uses mechanical state digest. Current timestamp and the root key shared with electronic key B (16 bytes) The temporary session key for this session is generated using the time-sensitive key derivation function. (16 bytes): In the formula, This is the session key, a 16-byte temporary key used only for encryption and decryption operations in the current authentication session; The root key is a 16-byte long-term key that is pre-shared between electronic key B and core control board E1. This is a random number generated by the control board E1, which is an 8-byte random number used to ensure freshness. The random number for the electronic key is an 8-byte random number generated by electronic key B and sent to the control board during the initial authentication phase. The bitwise XOR operator operates on two binary data of the same length. If the corresponding bits are the same, the result is 0; otherwise, it is 1. This derivation process ensures that the session key is dynamically related to the current mechanical operation state, time, and random numbers of both parties, and is unpredictable.

[0036] Step S5, Two-way Challenge-Response Authentication Step S51: The control panel challenges the electronic key: Core control board E1 generates challenge random numbers (8 bytes), using session key After encryption, send to electronic key B: Step S52, Electronic key responds and reverses the challenge: Electronic key B receives secret Using the same locally derived Electronic key B executes steps S3 and S4 simultaneously and needs to obtain data from the control board. and Decrypt to obtain Subsequently, electronic key B generates a response random number. (8 bytes), calculate the response value: In the formula, The encrypted response sent by the electronic key; The response random number generated for the electronic key is an 8-byte random number; At the same time, electronic key B generates a reverse challenge random number. (8 bytes), encrypted and sent to the control board: In the formula, The (reverse) challenge ciphertext sent for the electronic key; (Reverse) challenge random number generated by the electronic key; Electronic key B will and Send by splicing; Step S53: The control board verifies the response and acknowledges the action. After receiving the data, the core control board E1 first decrypts it. get , with local storage Perform XOR recovery If the restored If valid (not all zeros), then electronic key B's identity authentication is successful; Next, the control board E1 is decrypted. get Generate response value: In the formula, The encrypted response from the control board to the electronic key's reverse challenge; This section summarizes the mechanical condition. The integrated response ensures that electronic key B must be aware of the current mechanical state to complete verification; the control board will... Send to electronic key B; Step S54, Final Verification of the Electronic Key: Electronic Key B Decryption get , with local storage XOR results Electronic key B will The status digest is compared with the status digest calculated by the core control board based on the received mechanical status characteristics (partial feature values ​​sent in plaintext by the control board in step S3); if they match, the core control board E1 identity authentication is successful, and both parties confirm that the mechanical operation status is synchronized and valid.

[0037] Step S6: Lock status verification and linkage authorization After successful two-way authentication, the core control board E1 detects the current state of the mechanical lock pin C4 (determined by the steady-state signal of the micro switch D1). If C4 is in the "unlocked" state (indicating that mechanical key A has been legally operated), the control board E1 drives the electromagnetic actuator to release the intelligent electronic lock pin C8. The LCD display of electronic key B shows "A group authentication passed, electronic lock pin released," and prompts B group personnel that they can operate handle C3. Step S7: Authorization Result Feedback and Operation Permission Granting Electronic key B records a complete authentication log locally, including: timestamp, RF-IDs of both parties, and machine condition summary. (Anonymized) Authentication results; simultaneously, encrypted logs are uploaded to the backend management system via Bluetooth or TYPE-C interface; the core control board E1 maintains the electronic lock pin C8 in the released state for a maximum of 30 seconds. If the handle C3 is not lifted during this period, C8 will be automatically relocked, and authentication must start again from step S1. Step S8: Authentication failure handling and security policy execution. If any of the above authentication steps fail (such as RF-ID mismatch, challenge-response verification error, abnormal mechanical status, etc.), the core control board E1 will execute the following security policy: immediately lock the electronic lock pin C8 and ignore subsequent operation requests; An error code is sent to electronic key B, which displays "Authentication failed" and logs the event. The control board E1 has initiated an exponential backoff mechanism, and the next authentication attempt will be delayed. seconds (n is the number of consecutive failures, with a maximum of 5); If the number of consecutive failures exceeds three, the control board E1 will issue an audible and visual alarm via its built-in buzzer and send a real-time alarm to the security center via an IoT module (such as NB-IoT). In this specification, the terms "an embodiment," "example," "specific example," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0038] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A two-way authentication method for AB dual-lock cabinets based on SM4 and RF-ID, characterized in that, The method, applied to a dual-lock system comprising a mechanical lock authentication unit and an intelligent electronic lock authentication unit, includes the following steps: After the smart electronic key is inserted into the core control board and a connection is established, both parties conduct a preliminary mutual verification based on the RF-ID identifier and the preset code; The physical state signals triggered by the operation of the mechanical key are collected in real time, and the physical state signals are fused with time information to generate a dynamic mechanical state summary. Based on the machine state summary, current time information, root key shared by both parties, and randomly generated numbers, a temporary session key for the current session is generated through a time-sensitive key derivation process. The core control board and the smart electronic key use the temporary session key to execute a two-way challenge-response authentication process, wherein the challenge response verification issued by the core control board and the reverse challenge response verification issued by the smart electronic key are both successful, and the mechanical state summary is incorporated into the reverse challenge response verification process to complete two-way identity authentication and electromechanical state synchronization confirmation. After successful two-way authentication and detection that the mechanical locking pin is in the unlocked state, the core control board drives the electronic locking pin to release, thus completing the authorization to open.

2. The method for bidirectional authentication of AB dual-lock cabinets based on SM4 and RF-ID according to claim 1, characterized in that, The preliminary mutual verification steps specifically include: The core control board reads the unique RF-ID identifier stored in the smart electronic key; The smart electronic key sends a preset smart control code to the core control board. This code includes classification information, area information, and device identification information. The core control board compares the received RF-ID identifier and smart control code with the local list of legitimate authorizations. Only after both are verified will the subsequent authentication process be initiated.

3. The method for bidirectional authentication of AB dual-lock cabinets based on SM4 and RF-ID according to claim 1, characterized in that, The steps for generating a dynamic summary of the mechanical state specifically include: Within a preset time window, the level status signals output by the sensors associated with the mechanical key operation are continuously collected at fixed time intervals to form an original state sequence. The original state sequence is concatenated and combined with the current high-precision timestamp; The first cryptographic hash algorithm is used to process the concatenated data to obtain the first intermediate data; The first intermediate data is encrypted using the SM4 encryption algorithm with a preset seed key. Extract a data segment of a specified length from the encryption result as the machine state digest.

4. The method for bidirectional authentication of AB dual-lock cabinets based on SM4 and RF-ID according to claim 1, characterized in that, The time-sensitive key derivation process specifically includes: The core control board generates a first random number, and the smart electronic key generates a second random number, which are exchanged during initial mutual verification or subsequent communication. The core control board and the smart electronic key each use the same shared root key to perform SM4 encryption on two different sequences of data blocks. Each data block contains the mechanical state digest, the current timestamp, and the exchanged random number. Perform a bitwise XOR operation on the outputs of the two SM4 encryption operations to obtain the final temporary session key.

5. The method for bidirectional authentication of AB dual-lock cabinets based on SM4 and RF-ID according to claim 1, characterized in that, The challenge and verification steps initiated by the core control board in the two-way challenge-response authentication process include: The core control board generates a third random number as a challenge number, which is then encrypted using the SM4 algorithm with the temporary session key and sent to the smart electronic key. The smart electronic key decrypts to obtain the challenge number, generates a fourth random number as the response number, performs a first logical operation on the challenge number and the response number, and then uses the temporary session key to encrypt and form the first response ciphertext. The smart electronic key simultaneously generates a fifth random number as a reverse challenge number, which is then encrypted using the temporary session key and sent together. The core control board decrypts the first response ciphertext, performs a reverse first logical operation on the obtained data to separate the response number, and verifies its validity.

6. The method for bidirectional authentication of AB dual-lock cabinets based on SM4 and RF-ID according to claim 5, characterized in that, The reverse challenge and verification steps initiated by the smart electronic key in the two-way challenge-response authentication process include: After verifying the validity of the response number, the core control board decrypts to obtain the reverse challenge number; The reverse challenge number and the machine state digest are subjected to a second logical operation, and the operation result is encrypted using the temporary session key to form a second response ciphertext, which is then sent to the smart electronic key. The smart electronic key decrypts the second response ciphertext and performs a reverse second logical operation on the obtained data to extract the verification value of the mechanical state summary; The smart electronic key compares the verification value with its local state summary calculated based on the mechanical state feature information obtained from the core control board. If the two match, it confirms that the core control board is legitimate and the mechanical state is synchronously valid.

7. The method for bidirectional authentication of AB dual-lock cabinets based on SM4 and RF-ID according to claim 1, characterized in that, After the authorization is enabled, the process also includes operation execution and logging steps: The smart electronic key displays the authorization success status and operable operation prompts on its screen. The core control board maintains the electronic lock pin in the released state for a limited time, and automatically relocks if no handle operation is detected after the time limit. The smart electronic key and the core control board respectively encrypt and upload operation logs containing timestamps, identity identifiers, authentication results, and de-identified mechanical status information locally and / or to the superior management system.

8. The method for bidirectional authentication of AB dual-lock cabinets based on SM4 and RF-ID according to claim 1, characterized in that, The method also includes authentication failure handling steps: If a verification error occurs at any stage of the initial mutual verification, key derivation, or two-way challenge-response authentication, the authentication process shall be terminated immediately and the electronic lock shall be locked. A delayed retry mechanism is activated, and the next authentication attempt will have to wait for a delay time dynamically calculated based on the number of consecutive failures; When the number of consecutive failures reaches a threshold, a local audible and visual alarm is triggered, and a security alarm message is sent to the remote monitoring center via the network communication module.

9. The method for bidirectional authentication of AB dual-lock cabinets based on SM4 and RF-ID according to claim 1, characterized in that, The smart electronic key integrates a rechargeable battery, which provides power to the core control board when inserted, ensuring that the authentication process can still proceed normally when the lock body has no independent external power supply.

10. A two-way authentication method for AB dual-lock cabinets based on SM4 and RF-ID according to claim 6, characterized in that, The first logical operation and the second logical operation are bitwise XOR operations.

Images